All,
As you may have seen, a new revision of the AUTH_SESSION draft was submitted. The new revision was done
to address the comments raised during IESG review, specifically from the Security AD - Steven Bellovin.
Here is a summary of the comments received from the Security AD:
-Lack of detail regarding the security mechanisms described in the draft. Concerns that this lack of detail
may not allow implementers to build interoperable systems.
Here is a summary of the changes.
- Terminology: Change the use of "shared private keys" to "shared symmetric keys"
- Section 4.2: Kerberos - Added more details on how to use Kerberos to ensure the integrity of the token.
- Added Sub-Section 4.3.1.1: X.509 V3 digital certificates. This sub-section was added to provide the details on how to use
X.509 V3 digital certificates to ensure the integrity of the token.
- Added Sub-Section 4.3.1.2: PGP Digital Certificates. This sub-section was added to provide the details on how to use PGP
digital certificates to ensure the integrity of the token.
- Added more details in section 6: Message processing rules. Basically, provided better guidance.
- Changed the title of the draft to "Session authorization Policy Element". This title is much more appropriate since this document's
main goal is the describe the AUTH_SESSION Policy Element.
- Security considerations section: Specified the need for NTP in the non-associated model to ensure proper clock synchronization.
- Clarified that fields of subtype UNICODE_DN are X.500 Distinguished name as defined in RFC-2253 as a UTF-8 string.
We worked directly with Steven to make sure we successfully addressed all of his concerns - thanks to Bert for facilitating
this interaction. Thanks also to Eric Rescorla for providing security advice.
Cheers,
Louis-Nicolas